Cyber Resilience

CVE-2023-29332

Crypto Weakness in Microsoft Azure Kubernetes Service

Published
12 September 2023
Modified
21 November 2024
Patch / advisory
CVSS Score v3.1 7.5
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS Score 0.028 85th percentile
Risk Priority 70 floored blend · peak EPSS

Summary

CVE-2023-29332 is a high-severity Use of Insufficiently Random Values (CWE-330) vulnerability in Microsoft Azure Kubernetes Service. Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 15% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

Microsoft Azure Kubernetes Service contains an elevation of privilege vulnerability tracked as CVE-2023-29332. The flaw stems from use of insufficiently random values combined with improper input validation, allowing an unauthenticated network attacker to obtain sensitive information from the affected Kubernetes control plane or node components. It carries a CVSS 3.1 score of 7.5 reflecting network attack vector, low complexity, and no required privileges or user interaction.

An attacker with network access can exploit the weakness to read confidential data that would otherwise be restricted, achieving partial elevation of privilege within the Azure Kubernetes Service environment. The vulnerability can be reached without authentication, increasing the potential scope of exposure in multi-tenant or publicly reachable clusters.

Microsoft’s Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-29332 provides official guidance on patches and configuration changes required to address the issue. The current EPSS score of 0.1522 with a recorded peak of 0.1953 indicates moderate and sustained exploitation interest following disclosure.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability Data

Microsoft Azure Kubernetes Service Elevation of Privilege Vulnerability

CWE(s)

Related Threats

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1606 Forge Web Credentials Credential Access
Adversaries may forge credential materials that can be used to gain access to web applications or Internet services.
T1606.001 Web Cookies Credential Access
Adversaries may forge web cookies that can be used to gain access to web applications or Internet services.
T1036.001 Invalid Code Signature Stealth
Adversaries may attempt to mimic features of valid code signatures to increase the chance of deceiving a user, analyst, or tool.
T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
T1110 Brute Force Credential Access
Adversaries may use brute force techniques to gain access to accounts when passwords are unknown or when password hashes are obtained.
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2025-62455Same vendor: Microsoft
CVE-2024-49073Same vendor: Microsoft
CVE-2023-21550Same vendor: Microsoft
CVE-2024-38021Same vendor: Microsoft
CVE-2025-59198Same vendor: Microsoft
CVE-2023-36406Same vendor: Microsoft
CVE-2025-47171Same vendor: Microsoft
CVE-2026-21229Same vendor: Microsoft
CVE-2023-21767Same vendor: Microsoft
CVE-2023-21818Same vendor: Microsoft

Affected Assets

microsoft
azure kubernetes service
all versions

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)

Detect
Catch it (NIST detect / respond)

Harden
Shrink the surface (DISA STIG)
  • 14 hardening rules · 5 OS baselines
Validate
Prove the fix (OWASP ASVS)

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-20

Security testing and developer training directly verify and enforce proper input validation, reducing exploitability of injection and malformed-data weaknesses.

addresses: CWE-20

Security testing and evaluation at multiple SDLC stages directly detects missing or flawed input validation, with the required remediation process ensuring fixes are applied.

addresses: CWE-330

Key generation under controlled management uses approved random-bit sources rather than insufficiently random values.

addresses: CWE-20

Directly implements checks on information inputs to reject invalid data before processing.

addresses: CWE-20

Spam protection mechanisms perform filtering and detection on inbound/outbound messages, directly compensating for missing or weak input validation of unsolicited content.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure SDLC practices directly enforce use of cryptographically strong RNGs and catch insufficient randomness during design, coding, and testing.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

prevents

Cryptographic controls require use of approved, sufficiently random values for keys and nonces.

finds

Security testing can detect weak randomness but does not prescribe the control itself.

prevents

Secure SDLC processes include verification steps that can catch insufficient randomness but do not directly specify RNG requirements.

prevents

Mandating input controls that include integrity checks and input validation ensures that untrusted data is examined before use, blocking the root cause of many injection and malformed-data weaknesses.

prevents

Security-by-design principles explicitly call for data validation and sanitization at every layer, reducing the chance that malformed or malicious input will be processed without scrutiny.

prevents

Secure coding standards explicitly prohibit use of weak or predictable random number generators.

Hardening callouts derived

Configuration rules from DISA STIG baselines that bear on weaknesses of the type cited by this CVE. Each rule is shown with the relationship its mapping actually records, against the CWE it was authored against. Derived via CVE→CWE over `controls_xwalks` (authoritative rows only; rows rated `none` are excluded).

Oracle Linux 8 (3 rules)
  • V-248563 The OL 8 SSH server must be configured to use strong entropy. prevents CWE-330
  • V-248599 OL 8 must enable the hardware random number generator entropy gatherer service. prevents CWE-330
  • V-248600 OL 8 must have the packages required to use the hardware random number generator entropy gatherer service. prevents CWE-330
Oracle Linux 9 (1 rule)
  • V-271511 OL 9 must enable the hardware random number generator entropy gatherer service. prevents CWE-330
RHEL 8 (4 rules)
  • V-244527 RHEL 8 must have the packages required to use the hardware random number generator entropy gatherer service. prevents CWE-330
  • V-230253 RHEL 8 must ensure the SSH server uses strong entropy. prevents CWE-330
  • V-230265 RHEL 8 must prevent the installation of software, patches, service packs, device drivers, or operating system components of local packages without verification they have been digitally signed using a certificate that is issued by a Certificate Authority (CA) that is recognized and approved by the organization. prevents CWE-20
RHEL 9 (1 rule)
  • V-257782 RHEL 9 must enable the hardware random number generator entropy gatherer service. prevents CWE-330

References